tools: Capture Shasums for current version only
What the developer wrote
Authored by ShahanaFarooqui
tools: Capture Shasums for current version only
Fixes #8753.
Changelog-None: Release process fix.
What changed, and why it matters
This is a release-script fix that changes which files get their checksums recorded. Previously, the script would include every file whose name started with the current version string, which could accidentally pick up leftover files from older releases sitting in the same directory. Now it only records checksums for the exact tarballs and zip file produced for this release. The risk is low, but a bad checksum list could in theory mislead users or build systems about what they are downloading.
Treat as a normal release-process hardening fix. Verify that the new glob covers all intended release artifacts for your platform and does not omit any expected file. No urgent security deployment is required.
Security signals we found
Release artifact integrity list could include unintended files
Glob pattern in checksum generation was overly broad
No cryptographic weakness introduced; fix is defensive
Evidence from the diff
In tools/build-release.sh, the sha256sum invocation changed from a glob (clightning-$VERSION) to explicit patterns (clightning-$VERSION-.tar.* and clightning-$VERSION.zip). The old pattern could match unrelated artifacts in release/ that happen to share the version prefix, causing SHA256SUMS to cover non-current files. The patch narrows the match to the expected release artifacts only. There is no code change to Core Lightning itself.
Changed components
tools/build-release.shrelease packaging / SHA256SUMS generationInspect captured patch +1 / −1
diff --git a/tools/build-release.sh b/tools/build-release.sh
index d59a4a7e..4789db66 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -223,7 +223,7 @@ fi
if [ -z "${TARGETS##* sign *}" ]; then
echo "Signing Release"
cd release/ || exit
- sha256sum clightning-"$VERSION"* > SHA256SUMS-"$VERSION"
+ sha256sum clightning-"$VERSION"-*.tar.* clightning-"$VERSION".zip > SHA256SUMS-"$VERSION"
gpg -sb --armor --default-key "$(gpgconf --list-options gpg | awk -F: '$1 == "default-key" {print $10}' | tr -d '"')" -o SHA256SUMS-"$VERSION".asc SHA256SUMS-"$VERSION"
cd ..
echo "Release Signed"
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.